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Jill: 

Below you will find answers to your submitted questions. These are university responses, not attributable to a single 
person. 

Scott 


1. Why has the university not told study participants about the data breach even though 
the university IRB overseeing the study was first notified 7 months ago? Especially when 
the IRB said multiple times in letters starting back in October that notifying study 
participants was their “primary concern”? Ethics experts have told us that 7 months seems 
like an unreasonably and unjustifiably long delay. 


The integrity of the EmPower Women study and the privacy and protection of study 
participants were and continue to be paramount. The UC San Diego principal investigator 
and the study team are not responsible for any delay in notification. Since first learning that 
participant files might have been stored in a manner in which they were accessible to non¬ 
study staff at Christie’s Place, the UC San Diego study team has been extremely diligent. 

The study team investigated and gathered facts, repeatedly called and met with the Board of 
Directors and previous leadership at Christie’s Place, conferred with the research sponsor, 
notified UC San Diego IRB and consulted with others within the university. The principal 
investigator paused all study activities immediately following the allegations and the 
university’s contract and grants office sent a letter terminating the partnership (including 
study activities and sub-award agreement) with Christie’s Place. 

UC San Diego faced difficulties investigating this matter because Christie’s Place is 
an independent entity and it was difficult to establish that a third party, such as Christie’s 
Place, had improperly stored files. In fact, previous leadership of Christie’s Place repeatedly 
denied to the study team that any improper storage had taken place. 

The bulk of the delay in notifying study participants was due to a failure by UC San 
Diego to fully examine all of the information gathered by the study team. The administrative 
leader responsible for that failure, who was not part of the study team, has been placed on 
leave. This action occurred prior to our becoming aware of your interest and your planned 
news story. 

After fully reviewing the facts gathered by the study team in March 2019, UC San 
Diego representatives demanded that Christie’s Place securely return all study and 
participant files to UC San Diego, as well as destroy all files on Christie's Place servers and 
electronic health records. The study team sought to ensure that the secure return and 
proper destruction of study data were completed before beginning the notification process to 
study participants. 
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2. Does the university intend to ever notify the participants and explain what happened 
and why? If so, when and how will that notification occur? 


Yes. UC San Diego intends to notify the participants in face-to-face meetings. University 
staff have been in the process of developing appropriate notification materials for quite some time. 
This notification process will begin in two to four weeks. 


3. Did the university decide not to tell the study participants of the breach because that 
could expose the university to more liability and potential lawsuits, which could be costly 
and damaging the university’s reputation? 


No. Although IRB minutes discuss potential risk to UC San Diego, the university did not 
make any decisions in this matter regarding liability concerns. Indeed, liability was not a factor. 
Once facts were fully examined, the university acted to begin the notification process to 
participants via face-to-face meetings. 


4. Why hasn’t the university notified San Diego County that its staff has access to 
confidential research data that the staff are not authorized to access? Does the university 
plan to ever tell the county about this? Is the university increasing the risk of harm to the 
study participants by not notifying the county, because as a result the county doesn’t know 
they should remove the unauthorized study data? 


The study team learned of allegations that Christie’s Place had uploaded participant data 
into its electronic health record to bill research encounters as clinical encounters with the County. 
These allegations were repeatedly brought to the attention of previous and current Christie’s Place 
leadership. UC San Diego was not able to determine if these allegations were in fact true and that 
such mis-billing actually occurred. Such alleged mis-billing would be unrelated to the EmPower 
Women study. San Diego County is not the sponsor of this research project. 


5. Documents show that multiple people, including the PI of the study, have told HRPP and 
institutional officials that the IRB’s handling of the data breach contradict researchers’ 
training on IRB, HIPAA, Privacy, and Compliance rules, and that the IRB’s delay in notifying 
participants and others is a breach of ethics. How does the university respond to that? 


The study team and IRB were in agreement that notification was needed, but questions 
arose within IRB about the notification process. Resolution of these questions took longer than 
expected; the university is working to correct the process. UC San Diego does not believe this 
incident involves a violation of HIPAA, but rather a violation of study protocol. Since March 2019, 
when the facts gathered by the study team were fully examined and a protocol violation was 
confirmed, UC San Diego has intended to notify the participants about the protocol violation. 
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6. Can the university confirm that the confidential participant data has been removed from 
unsecure/unauthorized servers and data portals at Christie’s Place? If so, please tell us 
when this happened. If not, please explain why not. 


In March 2019, the university insisted that all study data be securely returned or destroyed 
by Christie’s Place. 


7. Can you confirm that the DHHS Office of Human Research Protections has been notified 
about the breach (as outlined in 45 CFR46.103(b)(5)), which the IRB found to constitute 
serious noncompliance and an unanticipated problem involving risks to subjects? 


This was not a federally funded project so Section 46.103(b)(5) is not applicable; no 
notification was required to DHHS OHRP. 


8. Christie’s Place was relying on UCSD’s IRB for this research project. Were Christie’s 
Place employees who were involved in the study given training (for example, CITI training) 
to ensure they understood how to follow proper protocols related to confidentiality and 
privacy of research data? Why would the Christie’s Place clinical manager say the UCSD 
“IRB’s policies do not apply at Christie’s Place?” 


All study personnel, including staff at Christie's Place working on the EmPower Women 
study, completed all required human subjects protection training (e.g., CITI training). This training 
included ethical conduct of research, HIPAA provisions, confidentiality and privacy of participant 
involvement and data. 

All authorized study personnel were required to uphold IRB policies at Christie's Place. 


9. Who is ultimately responsible for deciding how this data breach will be handled from 
here on out? 


The UC San Diego compliance office. 


10. Can you confirm that the EmPower Women Study is currently suspended? (Meaning all 
aspects of the research study, including enrollment and treatment, are currently on hold.) 


On October 4, 2018, the principal investigator of the EmPower Women study 
suspended the study and ultimately terminated all EmPower Women-related research 
activities and contracts at Christie's Place. Since then, no study enrollment or treatment has 
occurred for the EmPower Women study. 
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